intervalhehehe virus

[steviep]

help desperatly needed.when i downloaded winrar from a site it came complete with a virus called intervalhehehe.can anyone please help me in removing as i am unable to use the internet

[Mickha]

I hadn't heard of this virus but after doing an internet search it seems a few people have been caught out with this fake download.
One post mentions that uninstalling winrar seems to have stopped it, but I don't know if it will be that simple.
I would try booting up in safe mode and do a system restore, to before you downloaded it, this sometimes works with non malicious spyware.

[steviep]

i did remove winrar as suggested but this made no difference i will try to boot up in safe mode i'll let you know how i got on

[balloonmoon]

I've got same problem. Downloaded winrar last night and getting the intervalhehehe pop up. I ran spybot and it got rid of the pop up but I still can't use google and some other sites. If I try to I get prompted to install a chinese language. My start up page is also fake microsoft securiety site which I beleive is a phishing site to some russians out to clean out my bank accounts.

[ianmc101]

I have the same problem - my son inadvetatntly downloaded winrar. I have run spybot and malware that have got rid of the annoying little pop-up but I still cannot access any search engines such as google or yahoo without being shown a page that says I have a virus and should download some protection. This is obvioulsy new as all the stuff I have seen has been posted in the last 3 or 4 days - but if anyone has any idea how to get rid of it I would be grateful

[balloonmoon]

I've done a system restore, ran spybot and adaware all in safe mode but i'm still infected. I can use dogpile for searches though.

[as6670]

After reading some of the problems here i will take a stab in the dark and suggest that your PCs host file has been modified without your knowledge. The file should look like this when you open it using notepad or wordpad:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost

To view the host file go to start>run and paste the following and hit ok.

for XP & Vista - C:\WINDOWS\SYSTEM32\DRIVERS\ETC

Locate the file thats called Hosts and open using notepad or wordpad and compare to the above. If you see any added entries in there do a back up of the host file then remove the suspect entries so that it looks like the above then save. Don't forget to create a back up.

Let us know how you get on and if this fixes the problem.

[steviep]

i tried what you suggested but i cant tell what has been added/modified.confused

[steviep]

i did a system restore, and scanned with superantispyware no problems found i am now able to go on-line not sure if this has fully removed the problem?

[Godfatherdon]

Only ever download software from original sites to avoid these,